-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.kordamp.json:json-lib-core | maven | < 3.1.0 | 3.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper comment handling in JSON parsing. The commit diff shows the fix was applied to JSONTokener.java's nextClean() method, adding an end-of-input check during comment processing. The added test case in TestJSONSerializer.java verifies proper exception handling for '/**' input, confirming the vulnerable code path. The nextClean() function is responsible for skipping whitespace and comments during tokenization, and the lack of EOF check in comment parsing could lead to parsing failures or resource exhaustion.